permission scheme

[xin_wang]

New developers will join a team to work on a web application project. As a project

administrator, Dom needs to ensure he has the proper access to control their permission.

Which of the following should Dom add to the project permission scheme?

1. Roles
2. Groups

[Trudy Claspill]

Hello @xin_wang 

Welcome to the Atlassian community. 

That appears to be an exam question. What is the source of the question?

Which do you think is the correct answer? What information are you using to arrive at your conclusion?

[xin_wang]

I think the answer is B, but the answer is A, I'm a little confused

[Alexander Hohmann]

Roles only work within one given project. But before that, Dom must have user rights for administering projects in Jira, which is controlled by user group membership (except in the free version of Jira). Once Dom has that right, he can manage project roles and grant them to new developers.

[Trudy Claspill]

The question says that Dom is a Project Administrator.

A project administrator does not have permission to manage the members of Groups (that means User Groups).

A project administrator does have permission to manage the members of Roles (Project Roles) for the projects that they administer.

If the Permission are assigned to Roles, then Dom can control the permissions for users in his project by assigning the users to the Roles that are granted the permissions, and removing users from Roles to revoke their permissions

Since Dom cannot manage the membership of Groups, if Groups are used in the Permissions then Dom cannot manage the permissions for users in his project. The User Administrator who manages Group memberships would control who has which permissions in Dom's projects.

[xin_wang]

Is it because roles allow you to manage permissions more finely?

[Trudy Claspill]

No, it is because a user that is only a Project Admin can manage the members of Project Roles and does not have permission to manage the members of Groups. The question says that Dom is a Project Admin.

If Groups are used in the project permissions the project admin cannot add users to the groups to grant the users permissions.

If Roles are used in the project permissions, then the project admin can grant permissions by adding the users to the Roles.

[Petru Simion _Simitech Ltd__]

Hi @xin_wang ,

Envisioning how Permission schemes work, witout an enterprise view on roles and groups is challenging.

The solution in an enterprise is requiring collaboration between the Jira admin who creates the groups and assigns users to group, creates roles and creates permission schemes, that are using roles and/or groups, and assignes those permission schemes to projects.

While groups are visible to an admin in the user management, users are added to roles in each and every project by a Project Admin. This makes the overall look of who has permission to do what in an enterprise not easy to view, at an enterprise level.

If your company is opened to using apps you can use Roles Dashboard for Jira , an app released by our company to provide easily how roles are distributed to projects in an enterprise.

You can search for all projecs and roles or just some projects and some roles within your enterprise.

The search result can be viewed in two perspectives.

Project - User - Role Perspective

User - Role - Project Perspective

This will give you an overall view that, together with the Permission Schemes will help you envision and decide how to configure your permissions.

Regards, 

Petru